'Phantom' withdrawal case concludes in UK court

A one-day trial that raises questions about the security of cash cards used in the U.K. and Europe concluded Thursday, with a decision expected in about a month.

Alain Job sued U.K. bank Halifax in March 2007 over eight withdrawals made from his account in February 2006. Job maintains he did not withdraw a cumulative £2,100 (US$3,100). He also maintains he did not authorize anyone else to withdraw the money.

Job decided to sue after the Financial Ombudsman Service (FOS), which mediates disputes between banks and customers, sided with Halifax.

Job is the first person to sue a U.K. bank over a phantom withdrawal and believes one possibility is that his card was cloned. Halifax maintains that it was his exact card that was used to perform the withdrawals and that either Jobs is knowingly trying to defraud the banks or was grossly negligent in handling his card and PIN (personal identification number).

Job admitted at one point during testimony to putting his cash card in his garden outside one night for some inexplicable reason, according to Alistair Kelman, an attorney who watched the proceedings in Nottingham County Court.

Job is represented pro bono by Stephen Mason, an attorney who specializes in the collection of digital evidence and has written about case law involving disputed cash-machine transactions.

Mason said late Thursday he could not discuss specific details of the case due to court rules. A Halifax spokesman also said the bank had no comment. An expert witness for Jobs said he also could not speak about the case yet.

Security experts who have studied cash-machine "phantom" withdrawals say there are proven ways that criminals can trick cash machines in certain circumstances into accepting bogus cards.

In the U.K. and throughout Europe, banks issue chip-and-PIN cards. They have an embedded microchip that's used to authenticate transactions and people must enter a four-digit PIN. The PIN must also be used for credit- and debit-card transactions, rather than in the U.S., where a signature completes the transaction.

Studies done by researchers at the University of Cambridge have looked in depth at the chip-and-PIN system and highlighted weaknesses.

The liability rules are different for phantom withdrawal cases in the U.K. than in the U.S., where banks must directly prove fraud in order to reject a claim. In the U.K., that responsibility is on the customer, and banks tend to steadfastly maintain there are no security issues with their systems.

If the judge finds in favor of Job, it could lead to a change where U.K. banks would have to provide a higher level of evidence for phantom withdrawals in order to push the liability to the customer.

The FOS handles about 100 cases a month concerning contested cash-machine transactions, some of which are phantom withdrawals, said spokeswoman Emma Parker. The majority of those cases are found in favor of customers, she said. But the FOS doesn't not have precise statistics available or releases information about specific cases.

The FOS has published anonymous case studies, some of which concern phantom withdrawals. Parker said "the cases we see turn on their individual circumstances, rather than on whether it is technically possible to clone a chip-and-PIN card."

It would seem that video cameras by cash machines would resolve cases, but that's not necessarily right. Even if there's video, a bank could still argue that the customer making the complaint colluded the person in the video in order to scam money.

There are at least 64,000 cash machines in the U.K., according to Link, a major transaction network provider. Not every one has a video camera, and in Job's case, there's no video evidence of the contested withdrawals.

Microsites

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel.
Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Related Whitepapers

Copyright 2018 IDG Communications. ABN 14 001 592 650. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.